Could you prove your security position tomorrow?
Evidence a regulator, insurer or board can actually rely on – not just a description.
What actually gets asked for
Most organisations can describe their security posture confidently. “We’ve got MFA.” “We review access periodically.” “We take this seriously.”
Fewer can produce specific, current evidence of it, in the format a regulator, an insurer, a funder or a board actually wants to see. That gap, not a lack of good controls, is usually what gets found out first.
The assessments
M365 Security Baseline Assessment
Maps your current configuration against Microsoft’s own best practice and the independent CIS framework. Identifies gaps in MFA, Conditional Access and security policy, the exact controls insurers price premiums against and regulators ask about first.
Duration: 2–3 days
Purview Compliance Assessment
A collaborative engagement evaluating your data governance controls. Designs a go-forward information governance and compliance strategy built on Microsoft Purview capabilities, including sensitivity labels, Data Loss Prevention and data retention policy.
Duration: 1–2 days
The four pillars
- Pillar 1: Financial Integrity – find and reclaim wasted spend.
- Pillar 2: Structural Readiness – build a data estate AI (and your auditor) can trust.
- Pillar 3: Security & Compliance – harden identity and prove your compliance position.
- Pillar 4: Operational Excellence – align to best practice and get ready for Copilot
Find out more in our webinar series
For Financial Services
From March 2027, all FCA-authorised firms must report operational incidents through a standardised process. A further requirement – an annual register of material third-party arrangements – applies only to enhanced-scope firms, Solvency II insurers, banks, building societies and similar. Either way, this pillar builds evidence useful to any firm’s operational resilience position.
For Professional Services
The SRA has moved from guidance to enforcement, and professional indemnity insurers are increasingly pricing premiums against evidence of specific controls, not general assurances.
For Not-for-Profit organisations
The 2025/26 Cyber Security Breaches Survey found 28% of charities experienced a breach in the past year. The Charity Commission expects trustees to demonstrate they’re managing that risk – not just aware of it.
But is it relevant to you?
“We already enforce MFA, so we’re covered.”
MFA enforcement is rarely as complete as it looks. Legacy authentication bypass and partial coverage are common. This shows you exactly where it holds and where it silently doesn’t, across Conditional Access and privileged access too.
“We already have Purview licences, why pay for an assessment?”
Owning the licences isn’t the same as having a strategy. Many estates have Microsoft Purview, but they haven’t applied a coherent labelling, DLP or data retention design. This assessment evaluates gaps in your compliance capability without making changes to your environment.
Watch the webinar
Webinar 3: Security & Compliance – 20 minutes, bite-size content, available on demand.
What good security policy looks like when someone finally asks for it.
What’s next?
With evidence in hand, Pillar 4 asks the question everyone’s been waiting for: are you actually ready to switch AI on?
You probably don’t need to be more secure. You need to be able to prove it.
Colin Riddle, our Chief Product Officer, has written an article on the difference between having reasonable controls and being able to prove them, and why that distinction matters more than it used to.
Join any, or all, of our four bite-size webinars.
Four 20-minute sessions, one per pillar, live weekly from Wednesday 5th August. Each covers the problem, what “good” looks like, and what the relevant assessment actually involves – no pitch deck marathon. Register once and choose the sessions that matter to you.
What you’ll learn in each webinar:
- Pillar 1: Financial Integrity – where cloud spend leaks typically occur, and how Ekco can help
- Pillar 2: Structural Readiness – what “AI-ready data” actually means, and how far off most estates are
- Pillar 3: Security & Compliance – what “good” security and compliance looks like in the context of AI
- Pillar 4: Operational Excellence – what has to be true before you switch Copilot on
Register for the AI-Ready Webinar Series
Available to watch live or view on demand afterwards:
-
- Pillar 1: Financial Integrity – Weds 5 Aug @ 11am. NOW AVAILABLE ON DEMAND
- Pillar 2: Structural Readiness – Weds 12 Aug @ 11am NOW AVAILABLE ON DEMAND
- Pillar 3: Security & Compliance – Weds 19 Aug @ 11am NOW AVAILABLE ON DEMAND
- Pillar 4: Operational Excellence – Weds 26 Aug @ 11am
